Analysis
-
max time kernel
21s -
max time network
20s -
platform
windows10-2004_x64 -
resource
win10v2004-20250207-en -
resource tags
arch:x64arch:x86image:win10v2004-20250207-enlocale:en-usos:windows10-2004-x64system -
submitted
17/02/2025, 15:48
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe
Resource
win7-20240729-en
windows7-x64
17 signatures
150 seconds
Behavioral task
behavioral2
Sample
b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe
Resource
win10v2004-20250207-en
windows10-2004-x64
9 signatures
150 seconds
Errors
Reason
Machine shutdown
General
-
Target
b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe
-
Size
418KB
-
MD5
b97812a2e6be54e725defbab88357fa2
-
SHA1
29baab2551064fa30fb18955ccc8f332bd68ddd4
-
SHA256
b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32
-
SHA512
922e875633f1ebb3168a1c67d6e6b0571c97a33e4f1b88a6be5fb62e2e817107d1efdbcbbf5153532f41d835a435e49df1d011e9c8b9006054ddf34da43a620a
-
SSDEEP
12288:FnvxplpMAX99S4B009MqyQMKNT7lVfAD8xE:FvxplpMAtU4Bl9MdQFT7lVIoS
Score
10/10
Malware Config
Extracted
Path
C:\ProgramData\readme.txt
Family
dragonforce
Ransom Note
Hello!
Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.
--- Our communication process:
1. You contact us.
2. We send you a list of files that were stolen.
3. We decrypt 1 file to confirm that our decryptor works.
4. We agree on the amount, which must be paid using BTC.
5. We delete your files, we give you a decryptor.
6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future.
--- Client area (use this site to contact us):
Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
>>> Use this ID: 81F2B1C14220E50881F2B1C14220E508 to begin the recovery process.
* In order to access the site, you will need Tor Browser,
you can download it from this link: https://www.torproject.org/
--- Additional contacts:
Support Tox: 1C054B722BCBF41A918EF3C485712742088F5C3E81B2FDD91ADEA6BA55F4A856D90A65E99D20
--- Recommendations:
DO NOT RESET OR SHUTDOWN - files may be damaged.
DO NOT RENAME OR MOVE the encrypted and readme files.
DO NOT DELETE readme files.
--- Important:
If you refuse to pay or do not get in touch with us, we start publishing your files.
24/11/2024 00:00 UTC the decryptor will be destroyed and the files will be published on our blog.
Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
Sincerely, 01000100 01110010 01100001 01100111 01101111 01101110 01000110 01101111 01110010 01100011 01100101
URLs
http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
Signatures
-
DragonForce
Ransomware family based on Lockbit that was first observed in November 2023.
-
Dragonforce family
-
Drops desktop.ini file(s) 15 IoCs
description ioc Process File opened for modification C:\Users\Admin\3D Objects\desktop.ini b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Users\Admin\Links\desktop.ini b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Users\Admin\Videos\desktop.ini b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Users\Admin\Documents\desktop.ini b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Users\Admin\Music\desktop.ini b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Program Files\desktop.ini b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Users\Admin\OneDrive\desktop.ini b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Users\Admin\Searches\desktop.ini b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Program Files (x86)\desktop.ini b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Trial-pl.xrm-ms b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File created C:\Program Files (x86)\Common Files\Java\readme.txt b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_OEM_Perp-ppd.xrm-ms b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File created C:\Program Files\Microsoft Office\root\vreg\readme.txt b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019XC2RVL_KMS_ClientC2R-ppd.xrm-ms b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp4-pl.xrm-ms b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File created C:\Program Files (x86)\Microsoft\Edge\readme.txt b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessR_Grace-ul-oob.xrm-ms b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Retail-pl.xrm-ms b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Program Files\Java\jdk-1.8\include\jvmticmlr.h b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Excel2019VL_KMS_Client_AE-ppd.xrm-ms b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_SubTest-ppd.xrm-ms b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Program Files\RevokeOptimize.vssx b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File created C:\Program Files\Common Files\microsoft shared\Source Engine\readme.txt b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusEDUR_Subscription-ul-oob.xrm-ms b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Standard2019VL_KMS_Client_AE-ppd.xrm-ms b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Program Files (x86)\Common Files\Services\verisign.bmp b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Program Files\7-Zip\Lang\ast.txt b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\AccessRuntimeR_PrepidBypass-ul-oob.xrm-ms b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\WordR_Retail-ul-oob.xrm-ms b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Program Files\ConfirmLimit.mpg b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial3-pl.xrm-ms b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Program Files\Mozilla Firefox\removed-files b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\readme.txt b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Program Files\7-Zip\Lang\mng2.txt b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Trial-ppd.xrm-ms b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\MondoVL_KMS_Client-ppd.xrm-ms b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File created C:\Program Files\Common Files\System\ado\readme.txt b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File created C:\Program Files\Mozilla Firefox\gmp-clearkey\readme.txt b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\tzdb.dat b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioProCO365R_SubTest-pl.xrm-ms b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Program Files\7-Zip\Lang\ku-ckb.txt b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest1-pl.xrm-ms b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription4-pl.xrm-ms b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Trial-ul-oob.xrm-ms b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioStdO365R_Subscription-ul-oob.xrm-ms b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\MondoR_OEM_Perp-ppd.xrm-ms b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp5-ppd.xrm-ms b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\POWERPNT.VisualElementsManifest.xml b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019VL_MAK_AE-ppd.xrm-ms b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Program Files\7-Zip\Lang\ug.txt b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\uninstall.log b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ipsel.xml b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ExcelVL_KMS_Client-ul.xrm-ms b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019VL_MAK_AE-ppd.xrm-ms b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Trial-ppd.xrm-ms b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Program Files\UnregisterSave.vsdx b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Program Files (x86)\Common Files\System\Ole DB\oledbvbs.inc b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Retail-ul-oob.xrm-ms b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_OEM_Perp-ppd.xrm-ms b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Grace-ppd.xrm-ms b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Program Files\7-Zip\Lang\uk.txt b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Program Files\dotnet\swidtag\Microsoft Windows Desktop Runtime - 8.0.2 (x64).swidtag b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\hwrespsh.dat b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Retail-ul-oob.xrm-ms b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Grace-ppd.xrm-ms b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Trial-ul-oob.xrm-ms b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioProVL_KMS_Client-ul.xrm-ms b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Program Files\7-Zip\Lang\lij.txt b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\mscss7cm_es.dub b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OFFSYMXL.TTF b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\AccessR_OEM_Perp-ppd.xrm-ms b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1864 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 1864 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 1864 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 1864 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 1864 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 1864 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 1864 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 1864 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 1864 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 1864 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 1864 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 1864 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 1864 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 1864 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 1864 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 1864 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 1864 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 1864 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 1864 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 1864 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 1864 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 1864 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 1864 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 1864 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 1864 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 1864 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 1864 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 1864 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 1864 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 1864 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 1864 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 1864 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 1864 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 1864 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 1864 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 1864 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 1864 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 1864 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 1864 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 1864 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 1864 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 1864 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 1864 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 1864 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 1864 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 1864 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 1864 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 1864 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 1864 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 1864 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 1864 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 1864 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 1864 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 1864 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 1864 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 1864 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 1864 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 1864 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 1864 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 1864 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 1864 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 1864 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 1864 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 1864 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe -
Suspicious use of AdjustPrivilegeToken 45 IoCs
description pid Process Token: SeBackupPrivilege 4948 vssvc.exe Token: SeRestorePrivilege 4948 vssvc.exe Token: SeAuditPrivilege 4948 vssvc.exe Token: SeIncreaseQuotaPrivilege 3192 WMIC.exe Token: SeSecurityPrivilege 3192 WMIC.exe Token: SeTakeOwnershipPrivilege 3192 WMIC.exe Token: SeLoadDriverPrivilege 3192 WMIC.exe Token: SeSystemProfilePrivilege 3192 WMIC.exe Token: SeSystemtimePrivilege 3192 WMIC.exe Token: SeProfSingleProcessPrivilege 3192 WMIC.exe Token: SeIncBasePriorityPrivilege 3192 WMIC.exe Token: SeCreatePagefilePrivilege 3192 WMIC.exe Token: SeBackupPrivilege 3192 WMIC.exe Token: SeRestorePrivilege 3192 WMIC.exe Token: SeShutdownPrivilege 3192 WMIC.exe Token: SeDebugPrivilege 3192 WMIC.exe Token: SeSystemEnvironmentPrivilege 3192 WMIC.exe Token: SeRemoteShutdownPrivilege 3192 WMIC.exe Token: SeUndockPrivilege 3192 WMIC.exe Token: SeManageVolumePrivilege 3192 WMIC.exe Token: 33 3192 WMIC.exe Token: 34 3192 WMIC.exe Token: 35 3192 WMIC.exe Token: 36 3192 WMIC.exe Token: SeIncreaseQuotaPrivilege 3192 WMIC.exe Token: SeSecurityPrivilege 3192 WMIC.exe Token: SeTakeOwnershipPrivilege 3192 WMIC.exe Token: SeLoadDriverPrivilege 3192 WMIC.exe Token: SeSystemProfilePrivilege 3192 WMIC.exe Token: SeSystemtimePrivilege 3192 WMIC.exe Token: SeProfSingleProcessPrivilege 3192 WMIC.exe Token: SeIncBasePriorityPrivilege 3192 WMIC.exe Token: SeCreatePagefilePrivilege 3192 WMIC.exe Token: SeBackupPrivilege 3192 WMIC.exe Token: SeRestorePrivilege 3192 WMIC.exe Token: SeShutdownPrivilege 3192 WMIC.exe Token: SeDebugPrivilege 3192 WMIC.exe Token: SeSystemEnvironmentPrivilege 3192 WMIC.exe Token: SeRemoteShutdownPrivilege 3192 WMIC.exe Token: SeUndockPrivilege 3192 WMIC.exe Token: SeManageVolumePrivilege 3192 WMIC.exe Token: 33 3192 WMIC.exe Token: 34 3192 WMIC.exe Token: 35 3192 WMIC.exe Token: 36 3192 WMIC.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1864 wrote to memory of 3604 1864 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 90 PID 1864 wrote to memory of 3604 1864 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 90 PID 3604 wrote to memory of 3192 3604 cmd.exe 92 PID 3604 wrote to memory of 3192 3604 cmd.exe 92 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe"C:\Users\Admin\AppData\Local\Temp\b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe"1⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1864 -
C:\Windows\SYSTEM32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{BD05F8EA-56BF-42F3-A968-E715800B2196}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:3604 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{BD05F8EA-56BF-42F3-A968-E715800B2196}'" delete3⤵
- Suspicious use of AdjustPrivilegeToken
PID:3192
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4948
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5a5960d3a0f2b4f17e9220820060482dc
SHA184163d5b0ca469c80e7ca9f354be6a06b3fdf474
SHA25680992369c2e7fb7440f6a9fda3ba9fc6f06dc726f073d62eda61c8d27b50cf52
SHA512341f4221621e886b074d628c8d5a3614c1a855ef1533dc8869b17a0df155c33c7f75a09f394041e2e8c410a8786d4b01053454af756438040b86220fd6bfd74e